Posts by fulltilt

  • Plugin Installation in stable

    in der stable gibt es ja momentan diesen Bug bei der Plugin Verwaltung:

    Code
    1. Fixed: Use of undefined constant SORT_NATURAL


    kann man so trotzdem Plugins installieren oder sollte man besser das Update abwarten?
    würde gerne das SpamAssassin Plugin installieren und bin mir jetzt nicht sicher ob nachher alles funktioniert

  • how to set mail quota also for roundcube to unlimited

    because of many customers complain the mail quota ;(
    many user have 50-100 mail accounts and they do not want constantly adjust the qouta of all their mail accounts, I decided to set all accounts to unlimited.


    ### edit ###
    I guess this should work:

    SQL
    1. UPDATE mail_users SET quota = "0";
    2. UPDATE domain SET mail_quota = "0";

  • prevent direct access to PMA and Filemanager

    Hello Nuxwin,
    the modification will generate a new (personal) cookie if the location is /admin or /client:

    Code
    1. Header set Set-Cookie: "YourCookieName=YourSecret123456; path=/;"


    if you try to call /pma or /tools/pma you will be redirected to the ControlPanel

    Code
    1. <Location /tools/pma> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location>


    I know this is a simple cookie protection only but it will be more comfortable for the User as htaccess password Protection ... and if a User gives a htaccess password to others everyone can access htaccess protected areas ...


    It would be better to use a random value for the cookie but this can be done only in the PHP sources (I dont want to touch or change it) ...


    the auto PMA login from sql_manage.tpl will not work because of the header location from pma_auth.php ... and so I changed the PMA URLs to:

    Code
    1. nano /var/www/imscp/gui/themes/default/client/sql_manage.tpl
    4. change:
    5. pma_auth.php?id={USER_ID}
    8. to:
    9. {PMA_PATH}

  • prevent direct access to PMA and Filemanager

    For all those who are just as paranoid as I am ;-)


    This modification prevents direct access to PMA and Filemanager, you have to login into the control panel first.


    IMPORTANT: this is working only with version starting @ Latest Stable-Release: 1.1.2
    because of different V-Host entrys in earlier version


    replace with your details:
    - YourSecret123456
    - YourCookieName
    - https://admin.YourPanelURL.tld



    Code
    1. a2enmod headersservice apache2 restart



    Code
    1. nano /etc/apache2/sites-available/00_master.confbelow: <LocationMatch ^/.*/themes/.*/assets/.*$> Allow from all </LocationMatch>add: <LocationMatch /client> Header set Set-Cookie: "YourCookieName=YourSecret123456; path=/;" </LocationMatch> <LocationMatch /admin> Header set Set-Cookie: "YourCookieName=YourSecret123456; path=/;" </LocationMatch> <Location /pma> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location> <Location /filemanager> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location> <Location /tools/pma> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location> <Location /tools/filemanager> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location>


    Code
    1. nano /etc/apache2/sites-available/00_master_ssl.confbelow <LocationMatch ^/.*/themes/.*/assets/.*$> Allow from all </LocationMatch>add: <LocationMatch /client> Header set Set-Cookie: "YourCookieName=YourSecret123456; path=/;" </LocationMatch> <LocationMatch /admin> Header set Set-Cookie: "YourCookieName=YourSecret123456; path=/;" </LocationMatch> <Location /pma> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location> <Location /filemanager> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location> <Location /tools/pma> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location> <Location /tools/filemanager> RewriteEngine On RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456 [NC] RewriteRule .* https://admin.YourPanelURL.tld [L] </Location>


    service apache2 restart


    Code
    1. nano /var/www/imscp/gui/themes/default/client/sql_manage.tplchange:pma_auth.php?id={USER_ID}to:{PMA_PATH}


    also as administrator you have to log into the panel before you can use PMA, therefore we will create a custom menu entry in the Admin Panel:

    Code
    1. Login your ControlPanel as Administrator
    2. create a custom menu for PMA
    3. https://admin.YourPanelURL.tld/pma

  • PMA - An error occurred while authentication!

    but fail2ban is useless because recently a attacker is using IP pools from a botnet ...
    I have watched this many times ... the same IP will be used only one time and afterwards a new attack with a new IP is started
    no way to block this kind of attacks with iptables or whatever ...
    that is why PMA and Filemanager should be protected with a captcha or used only within the controlpanel

  • PMA - An error occurred while authentication!

    I have tried another solution with a cookie check and redirect to panel login ...
    the User have to login first before using PMA


    could it be that mod_rewrite is not working within the /tools folders?
    the cookie has been set but I guess rewrite (second htaccess) did not work
    fex:

    Code
    1. nano /var/www/imscp/gui/public/client/.htaccess
    2. Header set Set-Cookie "YourCookieName=YourSecret123456789abcd"
    5. nano /var/www/imscp/gui/public/tools/pma/.htaccess
    8. RewriteEngine On
    9. RewriteCond %{HTTP_COOKIE} !YourCookieName=YourSecret123456789abcd;? [NC]
    10. RewriteRule ^ https://admin.YourPanelURL.tld [R=301,L]

  • PMA - An error occurred while authentication!

    this htaccess should work but it's also blocking: